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From: 


b6 
To: b7Cc 
Ce: 
Sent: ursday, June 10, 1999 7:13 AM 


Subject: FOmpaxe  Couter rectly 1p whicele2) COs cet’s AKA 


Attached is the text displayed on our website. We have taken the site down and are in the process of gathering 
information on this group. 


Call it what you want - We own your dumb ass 


The w0rd is everywere like a virus 
People know what we are doing. People know what are our motives, but there are things that 
doesn?t want people to know. We have some infO about what?s happening and we will make it 
public because we must show who FBI really is and who is helping them. Consider this as 
their little secretes which aren?t so secret. 
FBI isn?t aware of what we really are capable, although they seem to be pretty interested on 
us. On this advisory you will see that they are asking to the admins to protect themselves 
from an eventual attack. National Infrastructure Protection center is the agencie responsable 
for this advisory?s that only some gov departments and ISP?s have access. There can be 
people who are aware of all this but we like all people to know. 
Read it and cry for more?... 

microchip / indde (Per euter exactly &s 
~ S oun ) Sub, eck s A KA 


Date: Tue, 08 Jun 1 18:40 -0700 

From | 

To: secret source b6 | 
Subject ANSIR Email Advisory 6/8/99 b7c 
The current FBI Los Angeles email advisory is transmitted to you for your ae 
use as deemed appropriate. Because of the varied email and word 
processing formats that exist, two versions of this communication are sent 
to each recipient. The first version is a text only email with no 
attachments. The second version includes the complete text of the 
advisory within the body of the communication, but also includes 
attachments. The attachments are in Word Perfect and Microsoft Word 
formats. The content of both attachments are identical, and include a 
graphic of the FBI Seal. The attachments are more suitable for 
duplication and distribution to Executives and other decision makers, or 
as a part of a security newsletter, training package, or other 

informational purpose. 


Any questions may be directed to Special Agents FBI Los 
Angeles Awareness of National Security Issues and Response (ANSIR) 


Coordinator, at 310-996-3557 mall tof or 800-734-1288 (Fax, only good for 


calls within California), or by email to} 


b6 
THE CURRENT ADVISORY FOLLOWS: a 
ANSIR Email ~ NIPC Hacker Advisory (99-010) bIE 


National Infrastructure Protection Center (NIPC) Well-publicized Hacker 
Activity Against U.S. Government Sites (NIPC warning 99-010) 


Ref. NIPC information system advisory 99-008 (11 May 99) This Awareness 
of National Security Issues and Response (ANSIR) communication is 


The Los Angeles office of the Federal Bureau of Investigation is located 

at 11000 Wilshire Boulevard, Los Angeles, CA 90024. The telephone number 
is 310-477-6565. The FBI Los Angeles Awareness of National Securi 

Issues and Response (ANSIR) Coordinator is Special Agente] 
Special Agent may be contacted at 310-996-3557 (voice), 
800-734-1288 (fax), or 7s hemnal if you are aware of 
individuals that would be interested in receiving future advisories, or 


would like to add others within your organization to the list of 
recipients, please forward the following information: 


Recipients Name 

Email Address 
Company/Organization Name 
Postal Address 

Voice Number 

Fax Number 


SA[____ lis also available to give presentations on various National 
Security related issues to appropriate audiences. Presentations are not 
classified, and will focus primarily on Economic Espionage and Theft of 
Trade Secrets or Proprietary Information. 


—--BEGIN PGP SIGNATURE----- 
Version: 2.6.2 


----END PGP SIGNATURE~——- 
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6/10/99 


b6 
b7¢ 
b7E 


ay 


intended for corporate security professionals and others who have 

requested to receive unclassified national security advisories. This 
communication is not a press release and should not be furnished to those 
who are not direct recipients of ANSIR Program disseminations or 
republished in any public format without specific authorization from the 
National ANSIR Program at FBIHQ. Media requests should be directed to the 
local FBI field office media representative. 


The purpose of this advisory is to summanze recent, well-publicized 
hacker activity against U.S. Government sites and provide an assessment 
and recommendations. 


On 26 May, the FBI Dallas office executed numerous simultaneous search 
warrants. Some of the individuals included in the searches were from the 
hacker group Global Hell. Allegedly because of these searches, persons 
claiming to be members of the group took credit for a subsequent denial of 
service attack on the FBI web site (hosted by IBM Global Networks). The 
U.S. Senate web site was also reportedly hacked in response to the FBI 
searches by the hacker group Masters of Downloading. Over the Memorial Day 
weekend, public reports of additional searches involving Global Hell 
members were followed by additional web page hacks including the 
Department of Interior (claimed by Global Hell) and the Department of 
Energy's Idaho National Engineering and Environmental Laboratory (claimed 
by FORPAXE). 


The reference message identifies the Portuguese hacker group FORPAXE and 
their initial activity over the past six weeks. In addition to the DOE 

Idaho laboratory, FORPAXE has claimed responsibility (on attrition.org) 

for dozens of additional web page hacks over the past few days of various 
commercial and public sites. These claims are uncorroborated and 
inconsistent with their prior U.S. Government and military web page 
hacking over the past six weeks. Unlike before, this weekend's hacking 
suggests the use of automated tools, and the language in their weekend 
statement reflects more hacker support than a Portuguese protest agenda. 
There is little direct evidence that FORPAXE is really or strictly a 
Portuguese-associated group. 


Ongoing investigations of this recent hacker activity may involve 
individuals both in the United States and overseas which highlights the 
lack of political and geographic boundaries in cyber space. This recent 
hacker activity may continue and may include a protest of and/or response 
to an expected June sentencing o 


Recommendations: NIPC suggests that recipients consider the following 
actions to protect information systems and networks: System and network 
administrators should examine their systems for intrusion exploits and 
report them as appropriate. 


NIPC encourages affected sites to retain as much relevant log information 
as possible, while re- establishing their web presence as quickly as 
organizational judgment and requirements suggest. Recipients are asked to 
report suspicious activity to your local FBI field office ANSIR or NIPC 
Coordinator and to your own organizational computer emergency response 
group, as appropnate. The NIPC can be located at Internet web site: 
www._nipc.gov. 
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